5 ms·

I'm glad that people are putting pressure on Apple to fix this and hope that they do. That being said, I think many comments here are out of touch. We're talki

by blub 6y ago

I'm glad that people are putting pressure on Apple to fix this and hope that they do. That being said, I think many comments here are out of touch. We're talking about a specialized security feature which is not easily available on other platforms is only used by a minority of users and still works for most programs. What exactly are your threat models that this is causing a problem for you? Are you sure that you can even use a mainstream OS if you need to block all outbound connections? If I had to have complete control over my outbound connections, I would use a hardware/software solution sitting between the computer and router. Secondly, is this really bypassing VPNs or only the new firewall API? e.g. is it bypassing WireGuard?

kjaftaedi 6y ago
>What exactly are your threat models that this is causing a problem for you? If I connect to a public wifi hotspot and use a VPN, I used to be under the general assumption that my network traffic would be sent through my network tunnel and not be accessible to other users of the same hotspot.
- tait 6y ago
  Agreed! One of the points of having a VPN is to be able to run software without every single middle man on the network knowing what you are running. For example, say someone hypothetically wanted to post a comment on twitter that, again, hypothetically, was politically inconvenient for some authority figure. The fact they launched twitter at about the time that comment was posted might be something they would prefer to not have reported on the internet at all, and certainly not without encryption. Generally, this falls into the general category of "I may disagree with what you say, but I will fight for your right to say it".
  - srg0 6y ago
    > without every single middle man on the network knowing what you are running with a different chain of middle men, ftfy.
- blub 6y ago
  I can't find Patrick Wardle claiming that Apple apps aren't routed through the VPN. This claim was made my "Maxwell", but they didn't provide any proof. Some VPNs were using kexts before Big Sur, some weren't. Wireguard for example is a normal AppStore app which integrates with the OS VPN support. It would suck to be confirmed that it's leaking traffic. For what it's worth, a VPN will not protect you from threats on a hostile network.
sneak 6y ago
> What exactly are your threat models that this is causing a problem for you? I would like my computer to not connect to anyone or anything when it's powered on if I'm not running interactive apps that I specifically wish to use the network. It's sort of like the bad old days with linux distros coming with like 47 listening services enabled by default. It took a while before they realized that defaulting things to "off" was the best move. I encourage you to look at the pcaps coming out of a fresh macOS install with everything turned off: App Store, iCloud, analytics, FaceTime, iMessage. You'd be surprised how much it's doing when it's sitting there "doing nothing".
- blub 6y ago
  Then you can't use Windows or macOS or a mainstream Linux. They've been doing this for a long long time and they're not going to stop.
  - steerablesafe 6y ago
    I would be surprised if Debian did anything like this. There is popularity-contest, but they are very explicit about it and it's opt-in. Other than that anything else would be considered as a bug.
  - sneak 6y ago
    > They've been doing this for a long long time Apple has only been doing this for 3 major OS releases, or about two years. On Windows you can run WPD[1] and turn it off, and also firewall the hosts it communicates with using the OS's built-in firewall. Big Sur won't let you block Apple apps now. [1]: https://wpd.app/ https://wpd.app/
    - holigot 6y ago
      You should give https://www.w10privacy.de/english-home/ https://www.w10privacy.de/english-home/ a try ;-)
tssva 6y ago
"We're talking about a specialized security feature which is not easily available on other platforms is only used by a minority of users and still works for most programs" I'm confused by this statement. We are talking about being able to implement firewalls and VPNs which can filter/redirect all outgoing connections. These are both abilities easily available on Windows and Linux.
- mrunkel 6y ago
  With root access you can bypass a VPN and firewall on Linux and Windows.
  - baq 6y ago
    also, with root access, you can force traffic to go through a vpn on Linux and Windows. root access is irrelevant here.
    - mrunkel 6y ago
      uhh. no. you can't. If my app has root access, you can't force me to do anything.
- blub 6y ago
  I was referring to software firewalls. Obviously it's bad if a VPN is leaking traffic, but that's not confirmed yet... or at least I couldn't find any proof of that in the linked tweets.
  - marcosdumay 6y ago
    Software firewalls like what comes by default on Windows since XP and Linux since... some version around 1997 I think?
    - blub 6y ago
      Filtering any outbound traffic on those is either outright not supported or not worth attempting.
Pr0Ger 6y ago
It still works only for legitimate apps. Any malware will use this loophole to bypass firewalls https://twitter.com/patrickwardle/status/1327726496203476992 https://twitter.com/patrickwardle/status/1327726496203476992
- blub 6y ago
  Little Snitch & co aren't anti-malware solutions even if they seem like they might work against that. Anything which is running on a malware-infected system can't be trusted. Such firewalls are used for protection against asshole developers which want to collect analytics without asking for confirmation. Apple are one of the assholes and LS can only be an interim solution against the OS developer. This was bound to happen... and I guess only a HW solution will help now.
  - count 6y ago
    Little Snitch & co are part of a defense in depth strategy against malware and other threats. Will it catch everything? No, obviously. Will it catch enough things to make it worth running? I guess that depends on your threat model, but many think it's worth it.
ec109685 6y ago
Packet based VPN’s like Cisco’s AnyConnect still function identically as before: https://developer.apple.com/documentation/networkextension/app_proxy_provider https://developer.apple.com/documentation/networkextension/a... “ A virtual private network (VPN) is a form of network tunnel where a VPN client uses the public Internet to create a connection to a VPN server and then passes private network traffic over that connection. If you want to build a VPN client that implements a flow-oriented, custom VPN protocol—one that works with the data passing through a TCP connection rather than the packets used to transport that data—create an app proxy provider app extension. When the system starts a VPN configuration that uses your app proxy provider, it launches your app extension, instantiates your app proxy provider subclass within that app extension, and starts forwarding flows to your provider. Each flow represents either a TCP connection or a conversation over UDP. Your provider is expected to open a tunnel to a VPN server and forward each flow over that tunnel. Similarly, if your provider receives flow data from the tunnel, it should pass that back to the system via the appropriate flow. App proxy providers are one form of per-app VPN, the other being a Packet Tunnel Provider in source application mode. App proxy providers are supported in iOS on managed devices only, and in macOS for Mac App Store apps only.” https://developer.apple.com/documentation/networkextension/app_proxy_provider https://developer.apple.com/documentation/networkextension/a... More explanation here: https://twitter.com/lorisscandurra/status/1327936829102952448?s=20 https://twitter.com/lorisscandurra/status/132793682910295244...

by blub 6y ago

kjaftaedi 6y ago

>What exactly are your threat models that this is causing a problem for you? If I connect to a public wifi hotspot and use a VPN, I used to be under the general assumption that my network traffic would be sent through my network tunnel and not be accessible to other users of the same hotspot.

tait 6y ago
Agreed! One of the points of having a VPN is to be able to run software without every single middle man on the network knowing what you are running. For example, say someone hypothetically wanted to post a comment on twitter that, again, hypothetically, was politically inconvenient for some authority figure. The fact they launched twitter at about the time that comment was posted might be something they would prefer to not have reported on the internet at all, and certainly not without encryption. Generally, this falls into the general category of "I may disagree with what you say, but I will fight for your right to say it".
- srg0 6y ago
  > without every single middle man on the network knowing what you are running with a different chain of middle men, ftfy.
blub 6y ago
I can't find Patrick Wardle claiming that Apple apps aren't routed through the VPN. This claim was made my "Maxwell", but they didn't provide any proof. Some VPNs were using kexts before Big Sur, some weren't. Wireguard for example is a normal AppStore app which integrates with the OS VPN support. It would suck to be confirmed that it's leaking traffic. For what it's worth, a VPN will not protect you from threats on a hostile network.

sneak 6y ago

> What exactly are your threat models that this is causing a problem for you? I would like my computer to not connect to anyone or anything when it's powered on if I'm not running interactive apps that I specifically wish to use the network. It's sort of like the bad old days with linux distros coming with like 47 listening services enabled by default. It took a while before they realized that defaulting things to "off" was the best move. I encourage you to look at the pcaps coming out of a fresh macOS install with everything turned off: App Store, iCloud, analytics, FaceTime, iMessage. You'd be surprised how much it's doing when it's sitting there "doing nothing".

blub 6y ago
Then you can't use Windows or macOS or a mainstream Linux. They've been doing this for a long long time and they're not going to stop.
- steerablesafe 6y ago
  I would be surprised if Debian did anything like this. There is popularity-contest, but they are very explicit about it and it's opt-in. Other than that anything else would be considered as a bug.
- sneak 6y ago
  > They've been doing this for a long long time Apple has only been doing this for 3 major OS releases, or about two years. On Windows you can run WPD[1] and turn it off, and also firewall the hosts it communicates with using the OS's built-in firewall. Big Sur won't let you block Apple apps now. [1]: https://wpd.app/ https://wpd.app/
  - holigot 6y ago
    You should give https://www.w10privacy.de/english-home/ https://www.w10privacy.de/english-home/ a try ;-)

tssva 6y ago

"We're talking about a specialized security feature which is not easily available on other platforms is only used by a minority of users and still works for most programs" I'm confused by this statement. We are talking about being able to implement firewalls and VPNs which can filter/redirect all outgoing connections. These are both abilities easily available on Windows and Linux.

mrunkel 6y ago
With root access you can bypass a VPN and firewall on Linux and Windows.
- baq 6y ago
  also, with root access, you can force traffic to go through a vpn on Linux and Windows. root access is irrelevant here.
  - mrunkel 6y ago
    uhh. no. you can't. If my app has root access, you can't force me to do anything.
blub 6y ago
I was referring to software firewalls. Obviously it's bad if a VPN is leaking traffic, but that's not confirmed yet... or at least I couldn't find any proof of that in the linked tweets.
- marcosdumay 6y ago
  Software firewalls like what comes by default on Windows since XP and Linux since... some version around 1997 I think?
  - blub 6y ago
    Filtering any outbound traffic on those is either outright not supported or not worth attempting.

Pr0Ger 6y ago

It still works only for legitimate apps. Any malware will use this loophole to bypass firewalls https://twitter.com/patrickwardle/status/1327726496203476992 https://twitter.com/patrickwardle/status/1327726496203476992

blub 6y ago
Little Snitch & co aren't anti-malware solutions even if they seem like they might work against that. Anything which is running on a malware-infected system can't be trusted. Such firewalls are used for protection against asshole developers which want to collect analytics without asking for confirmation. Apple are one of the assholes and LS can only be an interim solution against the OS developer. This was bound to happen... and I guess only a HW solution will help now.
- count 6y ago
  Little Snitch & co are part of a defense in depth strategy against malware and other threats. Will it catch everything? No, obviously. Will it catch enough things to make it worth running? I guess that depends on your threat model, but many think it's worth it.

ec109685 6y ago

Packet based VPN’s like Cisco’s AnyConnect still function identically as before: https://developer.apple.com/documentation/networkextension/app_proxy_provider https://developer.apple.com/documentation/networkextension/a... “ A virtual private network (VPN) is a form of network tunnel where a VPN client uses the public Internet to create a connection to a VPN server and then passes private network traffic over that connection. If you want to build a VPN client that implements a flow-oriented, custom VPN protocol—one that works with the data passing through a TCP connection rather than the packets used to transport that data—create an app proxy provider app extension. When the system starts a VPN configuration that uses your app proxy provider, it launches your app extension, instantiates your app proxy provider subclass within that app extension, and starts forwarding flows to your provider. Each flow represents either a TCP connection or a conversation over UDP. Your provider is expected to open a tunnel to a VPN server and forward each flow over that tunnel. Similarly, if your provider receives flow data from the tunnel, it should pass that back to the system via the appropriate flow. App proxy providers are one form of per-app VPN, the other being a Packet Tunnel Provider in source application mode. App proxy providers are supported in iOS on managed devices only, and in macOS for Mac App Store apps only.” https://developer.apple.com/documentation/networkextension/app_proxy_provider https://developer.apple.com/documentation/networkextension/a... More explanation here: https://twitter.com/lorisscandurra/status/1327936829102952448?s=20 https://twitter.com/lorisscandurra/status/132793682910295244...